The En Banc 11th Circuit Clarifies “Risk of Identity Theft” StandingIn a decision that narrows the path to federal court for plaintiffs seeking statutory damages with no actual harm, the full 11th Circuit has held that a plaintiff must plead a concrete injury to bring a claim based on an increased risk of identity theft. The en banc decision in Muransky v. Godiva Chocolatier, Inc. reverses a previous panel decision that upheld a class action settlement involving claims under the Fair and Accurate Credit Transaction Act (FACTA). We discussed that decision on this blog last year.

As we noted in our discussion of the panel opinion in Muransky, the plaintiff claimed a garden-variety FACTA violation: He alleged that Godiva printed the first six and last four digits of his credit card on his receipt. The case mediated, and the parties reached a class-wide settlement that would create a $6.3 million settlement fund to pay around $235 to each class member who submitted a claim form – with $2.1 million to class counsel. About 15% of the class members who received notice made claims, and there were five objectors. The objectors primarily focused on the issue of attorneys’ fees and the class representative’s $10,000 incentive award for serving as class representative. One objector asserted that the class representative lacked standing. The district court overruled the objections and approved the settlement. Two objectors appealed. After two panel opinions upholding the settlement, the en banc 11th Circuit reversed, with Judge Britt Grant writing for the majority.

The opinion focused on the issue of how concrete an injury must be to confer standing, and specifically how federal statutory rights play into that constitutional analysis. The court distilled the question into a two-step inquiry:

[W]e consider two things when we evaluate whether concrete harm flows from an alleged statutory violation—and thus whether the plaintiff has standing. First, we ask if the violation itself caused harm, whether tangible or intangible, to the plaintiff. If so, that’s enough. If not, we ask whether the violation posed a material risk of harm to the plaintiff. If the answer to both questions is no, the plaintiff has failed to meet his burden of establishing standing.

Under this rubric, the court found that receiving a non-compliant receipt is not a sufficient injury in itself. Receiving a non-compliant receipt does not violate any substantive right in a way that yields a concrete injury, the court found. Instead, an improper receipt was a “bare procedural violation” that Spokeo found insufficient to confer standing. Similarly, the time and energy the plaintiff spent safeguarding his receipt did not confer standing because the plaintiff did not allege that he actually spent any time and energy safeguarding a receipt. Likewise, the court rejected the notion that receiving a receipt is akin to a breach of confidence.

Turning to the second prong of the concreteness analysis, the court found that the plaintiff faced no risk of harm that conferred standing. This analysis hinged on how much weight the 11th Circuit was willing to give to Congress’ determination that untruncated receipts increase the risk of identity theft. The court engaged in a close analysis of FACTA to determine that Congress did not deem every FACTA violation to pose an actionable risk, but it ultimately asserted that the question of what risks confer standing is judicial, not legislative:

What Muransky asks is for us to abandon our judicial role by merging the ordinary steps in the analysis—concluding that because the statute protects a concrete interest, any violation automatically threatens that interest and thus supports standing. Although that approach would simplify our job, it is inconsistent with Spokeo and with what the Constitution demands of us.

[E]ven if Congress had explicitly stated in the text of the statute that every FACTA violation poses a material risk of harm, that alone would not carry the day. Although the judgment of Congress is an “instructive and important” tool to identify Article III injuries, we cannot accept Muransky’s argument that once Congress has spoken, the courts have no further role.

To determine whether the plaintiff could demonstrate a sufficient risk of injury, the court looked to the operative factual allegations and found them wanting.

There are three dissents, and they are too extensive to treat here. The dissents span 113 pages between them­­ –– against the majority’s 35 –– and they touch on the distinction between public and private rights, the procedural implications of the majority’s decision, separation of powers, and numerous other issues.

So what does Muransky mean?

Another blow to FACTA claims

As we have previously noted, FACTA claims have struggled after Spokeo, and Muransky further closes the door on such claims in the 11th Circuit. Pleading an actionable claim will require demonstrating a concrete injury or a material risk of injury, and that is a difficult task when most FACTA violations consist of nothing more than a cardholder receiving a receipt. Almost every FACTA plaintiff has a receipt to prove the injury, but the plaintiff’s possession of the receipt means that the plaintiff’s identity has almost certainly not been damaged by the receipt.

Another Hurdle for Federal Jurisdiction for Federal Statutory Claims

While we do not think Muransky restates the Eleventh Circuit’s standing test, it will certainly be cited against claims arising under other federal statutes that allow statutory damages in the absence of actual damages.

Another Hurdle for Certifying Classes

This is the most important point. Presumably, a FACTA plaintiff, or any plaintiff asserting a claim based on a risk of identity theft, will now go above and beyond to articulate a personal concrete injury with enough specificity to satisfy Muransky. But every personal fact asserted in support of the named plaintiff’s injury becomes an individualized fact that defendants can use in resisting class certification. If a plaintiff’s identity was stolen, representing a class of uninjured class members may be impossible. Plaintiffs who took particular steps to protect their identities or who suffered particular concern for the security of their identities may not be typical of a class who did not take those steps or share those concerns. A plaintiff who is too generalized in alleging harm gets kicked out of federal court. A plaintiff who is too specific in alleging harm may make class certification unlikely. Like Calvin from the old cartoon Calvin and Hobbes, alleging enough but not too much will be a challenge.

Another Hurdle in Data Breach Claims

We will be watching closely to see how courts treat Muransky outside of the context of federal statutory claims. Most consumer identity-theft cases assert negligence claims, but a common basis for standing is an allegation that the plaintiff and the class faced an increased risk of identity theft. This pleading pattern mirrors what the 11th Circuit addressed in Muransky, but without the overlay of Congressional findings.

Another Reason to Address Known Problems Up Front

The 11th Circuit attached great significance to the parties’ attempt to hustle their settlement through final approval before the anticipated release of the Supreme Court Spokeo opinion. That decision backfired on the plaintiff.  The 11th Circuit was not above sarcasm in pointing out what it called a “particularly acute” lack of unfairness:

We do not think it is too much to ask that litigants who are aware that their allegations may not satisfy constitutional standing requirements take the time to firm up those allegations—if it is possible to do so—before an en banc circuit court confirms their suspicions of inadequacy. This is not a case where a surprise standing issue was thrust upon an unaware plaintiff.

And, because the 11th Circuit dismissed the case without prejudice, the defendant faces the possibility of a new lawsuit. When settling, both parties share an interest in making sure jurisdiction exists and is adequately reflected in the record.

*          *          *

One global thought in closing. A treasured mentor taught me that judges will do the right thing within the law, and I think that rule applies here. The 11th Circuit summarized the event at the center of this case as “Muransky has alleged that a cashier handed him a receipt containing some of his own credit card information printed on it.” That event does not demand a remedy at a gut level, much less does it seem to justify awarding millions in damages and fees. FACTA is a draconian statute that imposes liability far beyond what seems reasonable. After all, what is it about that sixth credit card number that suddenly makes identity theft a risk? The 11th Circuit’s tacit view that FACTA is unfair comes through in Muransky. The court’s skepticism of Congress’ findings should be seen in parallel with its skepticism of FACTA as a whole. And the opinion repeatedly denigrates the parties’ attempt to consummate their settlement before the Spokeo decision. Parties would do well to remember these gut-level equities.